CVE-2022-28371

On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of devices. An attacker need only download this firmware and extract the private components of these certificates (from /etc/lighttpd.d/ca.pem and /etc/lighttpd.d/server.pem) to gain access. (The firmware download location is shown in a device's upgrade logs.)

• CWE-798

• https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.mdExploit, Third Party Advisory
• https://www.verizon.com/info/reportsecurityvulnerability/Vendor Advisory
• https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.mdExploit, Third Party Advisory
• https://www.verizon.com/info/reportsecurityvulnerability/Vendor Advisory

Published

Jul 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-28366Certain Neko-related HTML parsers allow a denial of service …7.5
• CVE-2022-28367OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smugglin…6.1
• CVE-2022-28368Dompdf 1.2.1 allows remote code execution via a .php file in…9.8
• CVE-2022-28369Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not…9.8
• CVE-2022-2837A flaw was found in coreDNS. This flaw allows a malicious us…6.1
• CVE-2022-28370On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devi…7.5
• CVE-2022-28372On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and O…7.5
• CVE-2022-28373Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not…9.8
• CVE-2022-28374Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does no…8.8
• CVE-2022-28375Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does no…9.8
• CVE-2022-28376Verizon 5G Home LVSKIHP outside devices through 2022-02-15 a…8.1
• CVE-2022-28377On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and O…7.5